feat(images): turn a stored photo a quarter turn (#301)

The file half of the remedy for what #300 could only stop. Fixing the EXIF strip means new uploads arrive the way the sender saw them; it cannot repair what is already stored, because the tag that said which way up the pixels went is gone. Those photos need a person to look at each one and turn it.

Rewrites the pixels rather than recording an angle, because an angle obliges every consumer to honour it — the storefront, both admin screens, the drafting worker's photo reader, and the rembg sidecar — and any one that forgets shows the photo sideways. The sidecar is not ours to teach.

Left is anticlockwise and right is clockwise, which is rotate(-90) and rotate(90); sharp reads a positive angle as clockwise. The direction test asserts a pixel rather than a dimension, because dimensions swap whichever way the turn goes — a reversed sign would pass every size assertion and ship a control that does the opposite of its label.

The animated WebP case is the one that could destroy someone's file quietly. Reading such a file without the animated flag succeeds and hands back the first frame alone, so a rotation that omitted it would write a still back over the animation and report success. Passing the same flag reencodeInPlace passes makes sharp refuse instead — multi-page images turn only by 180° — which is the honest answer and leaves the file untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/imageProcessing.ts

@@ -126,3 +126,66 @@ export async function reencodeInPlace(filePath: string, mimetype: string): Promi
     throw err;
   }
 }
+
+/** Which way a quarter turn goes, in the words the buttons use. */
+export type RotateDirection = 'left' | 'right';
+
+/**
+ * sharp reads a positive angle as clockwise, so the sign is the whole of the
+ * mapping — and getting it backwards produces a control that works perfectly
+ * and does the opposite of what its label says, which no dimension assertion
+ * would ever catch.
+ */
+const QUARTER_TURN: Record<RotateDirection, number> = { left: -90, right: 90 };
+
+/**
+ * Turns the file at `filePath` a quarter turn, in its own format.
+ *
+ * The remedy for photos uploaded before #300 taught the re-encode to apply EXIF
+ * orientation instead of discarding it. Those files cannot be repaired
+ * automatically — the tag that said which way up they went is gone — so a
+ * person has to look at each one and decide.
+ *
+ * Rewrites the pixels rather than recording an angle. An angle would keep the
+ * bytes pristine, but it would put an obligation on every consumer — the
+ * storefront, both admin screens, the drafting worker's photo reader, and the
+ * rembg sidecar — and any one that forgot would show the photo sideways. The
+ * sidecar in particular is not ours to teach.
+ *
+ * Same temporary-file-and-rename shape as `reencodeInPlace`, for the same two
+ * reasons: sharp cannot read and write one path in a single pass, and a process
+ * that dies mid-write must leave the old photo intact rather than half a new
+ * one.
+ *
+ * No `resize`. The file went through `reencodeInPlace` on upload and is already
+ * within bounds, so re-applying the cap would be a second lossy pass buying
+ * nothing. No metadata handling either: the re-encode already stripped it, and
+ * there is nothing left to strip.
+ */
+export async function rotateInPlace(
+  filePath: string,
+  mimetype: string,
+  direction: RotateDirection
+): Promise<void> {
+  const temporary = `${filePath}.rotating`;
+  try {
+    await encoderFor(
+      // Exactly the `animated` argument reencodeInPlace uses, and the reason is
+      // sharper here. Reading an animated WebP without it decodes the first
+      // frame alone, so omitting it would silently write back a still and
+      // destroy the animation while reporting success. With it, sharp refuses
+      // the rotation outright — multi-page images can only be turned 180° —
+      // which is the honest answer and surfaces as a 500 with the file
+      // untouched. A still WebP has one page and turns normally.
+      sharp(filePath, mimetype === 'image/webp' ? { animated: true } : {}).rotate(
+        QUARTER_TURN[direction]
+      ),
+      mimetype
+    ).toFile(temporary);
+
+    await fs.rename(temporary, filePath);
+  } catch (err) {
+    await fs.unlink(temporary).catch(() => undefined);
+    throw err;
+  }
+}